CVE-2017-1000223: XSS
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000223?
CVE-2017-1000223 is considered a moderate severity vulnerability due to the potential for an authenticated user to execute malicious JavaScript.
How do I fix CVE-2017-1000223?
To fix CVE-2017-1000223, upgrade MODX Revolution CMS to version 2.5.7 or later.
Who is affected by CVE-2017-1000223?
CVE-2017-1000223 affects users of MODX Revolution CMS version 2.5.6 and earlier with permissions to edit users.
What type of vulnerability is CVE-2017-1000223?
CVE-2017-1000223 is a stored web content injection vulnerability, also known as XSS.
What could be the impact of CVE-2017-1000223?
The impact of CVE-2017-1000223 could allow attackers to take control of victims' accounts by injecting malicious scripts.